> Contractors like Penn State are required to self-attest to compliance with 110 security requirements spelled out by the National Institute of Standards and Technology; there is no oversight, Newman wrote.

> The self-reported scores must be submitted before a defense contract is renewed or awarded. At least 20 records submitted to the government were falsified, the lawsuit alleged.

If you're not going to do any actual verification of the security of a subcontractor and just ask them to "self assess", with a significant financial incentive for them to lie to win a contract, you can't be too surprised when they....lie to win the contract.